Pablo Guides

# Course #116: dirsearch$ – Web Directory Scanner

## Section 1: Introduction to dirsearch$

### Overview

Dirsearch is a powerful web directory scanner that is part of the Kali Linux suite of penetration testing tools. It is designed to brute-force directories and files on web servers, helping security professionals identify potential vulnerabilities in web applications. This tool can be particularly useful for discovering hidden resources that may not be easily accessible through conventional navigation or search methods.

In this section, we will cover the installation and configuration of dirsearch on Kali Linux, followed by detailed usage instructions and real-world use cases. We will also provide technical explanations, along with code examples and useful external references to enhance your understanding and effectiveness in using dirsearch.

### Installation and Configuration on Kali Linux

Dirsearch is included by default in the Kali Linux repositories, making installation straightforward. Follow the steps below to install and configure dirsearch on your Kali Linux environment:

1. **Open a Terminal Window**

You can access the terminal through your application launcher or by pressing `Ctrl + Alt + T`.

2. **Update Kali Linux Packages**

Before installing any new tool, it's good practice to update your package list to ensure you have the latest version of all software. Run the following command:

   sudo apt update && sudo apt upgrade -y

 

3. **Install dirsearch**

To install dirsearch, use the following command:

   sudo apt install dirsearch

 

4. **Verify Installation**

Once installed, you can verify that dirsearch is available by checking its version:

   dirsearch –version

 

5. **Configuration**

Dirsearch doesn’t require extensive configuration out of the box. However, you may want to modify some default settings depending on your specific needs. The main configuration file can typically be found at:

[/dm_code_snippet]
/usr/share/dirsearch/dbs/
[/dm_code_snippet]

Here, you can add or modify the wordlists used for scanning. Dirsearch supports custom wordlists, so feel free to download or create your own as needed.

### Step-by-Step Usage

Now that dirsearch is installed, let's explore how to use it effectively. Below are the basic commands for running dirsearch, followed by real-world use cases.

#### Basic Command Syntax

The simplest way to run dirsearch involves specifying the target URL:

"`bash
dirsearch -u
"`

#### Example Command

To scan a web application located at `http://example.com`, you would use:

"`bash
dirsearch -u http://example.com
"`

#### Common Options

– `-u `: Target URL.
– `-w `: Specifies a custom wordlist to use.
– `-e `: File extensions to search for (e.g., `php,html`).
– `-t `: Number of concurrent threads to use (e.g., `10`).
– `–simple-report`: Generate a simple report of the findings.

### Real-World Use Cases

#### Use Case 1: Identifying Hidden Admin Panels

Many web applications may have hidden or sensitive directories such as admin panels. You can use dirsearch to find these potentially vulnerable endpoints.

1. **Use a common wordlist** to look for admin panels:

   dirsearch -u http://example.com -w /usr/share/dirsearch/dbs/common.txt

 

2. **Look for keywords** that indicate an admin interface, such as `admin`, `login`, or `dashboard`.

3. **Review the results** to identify any potentially sensitive directories that should be further tested or reported.

#### Use Case 2: Discovering Configuration Files

Configuration files, if exposed, can provide attackers with valuable information about the web application and its environment.

1. **Scan for common configuration file names**:

   dirsearch -u http://example.com -w /usr/share/dirsearch/dbs/config.txt

 

2. **Look for files** like `config.php`, `database.yml`, or others that could reveal sensitive data.

### Detailed Technical Explanations

#### Understanding HTTP Requests

Dirsearch operates by sending HTTP requests to the specified URL and parsing the responses to identify valid directories and files. The tool utilizes the status codes returned by the server to determine whether a scanned resource exists.

– **200 OK**: The request was successful; the resource exists.
– **403 Forbidden**: The request was valid, but the server is refusing to respond (possibly due to permissions).
– **404 Not Found**: The resource does not exist.

#### Wordlists

Wordlists are critical in brute-forcing directory structures. Dirsearch comes with several default wordlists, but custom wordlists can significantly improve effectiveness. You can create your own wordlist based on previous findings or use well-known lists from repositories like [SecLists](https://github.com/danielmiessler/SecLists).

#### Output Formats

Dirsearch offers various output formats for reporting results. The simple report option provides an easy-to-read summary, while the JSON and CSV formats facilitate further analysis or integration with other tools.

### External Reference Links

For further reading and deeper understanding, check the following resources:

– [Kali Linux Tools – dirsearch](https://www.kali.org/tools/dirsearch$)
– [GitHub – dirsearch Repository](https://github.com/maurosoria/dirsearch)
– [SecLists – Directory List](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/common.txt)
– [OWASP – Directory Traversal](https://owasp.org/www-community/attacks/Directory_Traversal)

### Code Examples in Markdown for WordPress

If you’re running a WordPress site and want to visually show how to use dirsearch, you can embed code snippets as follows:

"`markdown
#### Example of Running dirsearch

"`bash
dirsearch -u http://example.com -w /usr/share/dirsearch/dbs/common.txt
"`
"`

Keep in mind to ensure that your WordPress environment supports Markdown parsing correctly to display the code blocks.

## Conclusion

In this section, we covered the installation and configuration of dirsearch on Kali Linux, its basic usage, and real-world use cases. Understanding how to effectively utilize dirsearch can enhance your ability to uncover vulnerabilities in web applications, making it an essential tool in your pentesting arsenal.

—

Made by pablo rotem / פבלו רותם